Plaintext Storage of a Password in Jenkins Elasticsearch Query Plugin

MEDIUM 6.5CVE-2022-34807 · GHSA-h5h5-m2mc-j2pv · Published 30/06/2022 · updated 17/06/2026

In short

CVE-2022-34807 is a MEDIUM (CVSS 6.5) vulnerability affecting org.jenkins-ci.plugins:elasticsearch-query, elasticsearch query (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.74%, higher than 54.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:elasticsearch-query Maven	`≤ 1.2`	No fix yet
elasticsearch query jenkins	`≤ 1.2`	No fix yet

Description

Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file org.jenkinsci.plugins.elasticsearchquery.ElasticsearchQueryBuilder.xml on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

NVD description

Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

References

nvd.nist.gov/vuln/detail/CVE-2022-34807 · ADVISORY
jenkinsci/elasticsearch-query-plugin · PACKAGE
jenkins.io/security/advisory/2022-06-30 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free